First Flight #9: Soulmate

Summary

Vault::initVault lacks adequate access control mechanisms. This function is critical for initializing the vault with the LoveToken contract and setting the corresponding manager contract. However, malicious actors can monitor pending transactions within the Ethereum mempool and execute a transaction calling initVault with unauthorized parameters before the original transaction is confirmed. This vulnerability arises because any user can call initVault without restrictions, leading to potential unauthorized initialization.

Vulnerability Details

The Ethereum mempool is a holding area for transactions awaiting confirmation. Transactions in the mempool are publicly visible, allowing actors to observe and potentially exploit transactions that are not yet confirmed. The initVault function's current implementation does not restrict who can call it, nor does it ensure that the call comes from a trusted source. Consequently, an attacker can front-run the legitimate initialization transaction by submitting a similar call with a higher gas price, ensuring their transaction is confirmed first. This could result in the vault being initialized with an attacker-controlled manager contract, compromising the integrity and security of the vault and associated funds or operations.

Impact

Successful front-running of the initVault function call can lead to several adverse outcomes, including but not limited to:

1. Unauthorized control over the vault, including redirection of funds or manipulation of token distributions.

2. Loss of confidence in the security and reliability of the protocol, potentially deterring user participation.

3. Financial losses for users and the protocol due to unauthorized access and potential exploitation.

The protocol is forced to redeploy its contracts.

Tools Used

Manual review.

Recommendations

Add access control to Vault::initVault as follows: